data recover via file carving

I am doing data carving for a friend there computer lost the files and i had a few questions the first and more important question to me is how the factory reset may have happened. She claims to have left the computer on and when she got off work all her files were gone when i looked at the computer it had most factory based bloatware on it no other files besides the ones she installed after this happened i know of computers crashing after and needed to be re-installed after such an event but for it to be turned on when she got home with files no where to be found???? what could cause that a virus maybe, btw used bootable virus scanner and was clean.

the second one is i am familiar with encase and FTK for carving i tried steller phoenix but to back up need full version and i am fixing this for free so don't have 119 usd to by any suggestion need to recover ms word doccuments powerpoint photos music and videos prefer windows freeware, but if must i can use non cli-linux as i struggle with linux command line. program speed is not an issue need good software since she used it and installed more programs want one that can recover partailly overwritten files like FTK can but still without the high price if nessesary if stellar phoenix is worth it i can afford it just a little reluctant but i could use it in the future ( in the past while i was going to school for digital forensics used their software alot for data recovery for the community)

I use Piriform Recuva. It is an excellent file recovery program that does some automatic file carving (in Deep scan mode). You'll need to select "Deep scan", "Recover file structure", and "Recover non-deleted files" in the options before scanning.

Please take this opportunity to remind the original user of the importance of backups. I don't know the environment that the computer was in, but most likely the "Factory reset" was initiated by a malicious user. All the factory restore programs I'm familiar with require user intervention to operate. That's a good reason to put a password on your system BIOS, so that a malicious person can't just reboot your computer and press the Factory Restore key in the BIOS.

. She claims to have left the computer on and when she got off work all her files were gone when i looked at the computer it had most factory based bloatware on it no other files besides the ones she installed after this happened i know of computers crashing after and needed to be re-installed after such an event but for it to be turned on when she got home with files no where to be found???? what could cause that a virus maybe, btw used bootable virus scanner and was clean.

She would have wiped it (or someone she lives with). Obviously not intentionally, but the "factory reset" wouldn't have been done by malware.

Use Myjad Data Recovery Software http://www.myjad.com/data-recovery-wizard.html
If you can’t manually copy the user data off then you can try to recover it using data recovery software. Whatever you do, do not install the recovery software on to the drive that you are trying to recover data from. Doing so could actually overwrite files that you want to restore.Edited by millerbell - 8/28/13 at 2:12am